I passed my GCFA exam a few months back and I ended up with an extra practice test. If anyone would like it please just PM me. I will need your SANS portal ID to transfer the practice test. It expires in August I think. Sorry for the short time period but someone in my company had expressed interest in studying/taking the exam so I was holding on to it for them. Their loss your gain!

I read four different books for this exam they all helped on different parts. I didn't feel any of the books covered everything I ran into on the exam. Probably the one that helped the most was File System Forensic Analysis by Brian Carrier. The other three were: